Writing an AI policy for a small business: what to include, and an outline to copy

AI policy for a small business: the short answer

An AI policy for a small business needs five rules, and two pages is enough to hold them:

1. Which AI tools staff may use, on company accounts.
2. What information never goes into them.
3. Which uses need a named person's approval first.
4. Who checks AI output before it leaves the firm.
5. Who owns the policy, and when it's next reviewed.

A longer policy goes unread, and an unread policy protects nobody.

This guide is for the owner or operations lead of a 10 to 50 person firm in the UK or EU. Your staff already use ChatGPT, Copilot or Gemini for drafts and summaries, and nobody has written down the rules. Perhaps a client has asked whether you have an AI policy. Perhaps someone pasted in something they shouldn't have.

The usual first instinct is a ban. It's also the policy least likely to work, for reasons the next section covers. What works is narrower: an approved tool that beats the one on people's phones, and a short list of uses that need a person's decision.

We take small firms through getting AI into their work with AI consulting, starting by sitting with the team to see how the work actually runs. Our own rule is on our homepage. AI does "most of the production and none of the direction", and a person reviews the output before a client sees it. Your policy can be nearly that short, plus the detail below.

Why banning AI tools usually fails

A ban works only where you control every device and network your people use. Samsung could do that. A 20-person firm can't.

In April 2023, Samsung engineers uploaded internal source code to ChatGPT, according to a company memo reported by Bloomberg. Samsung then banned generative AI tools on company-owned computers, tablets and phones, and on its internal networks (TechCrunch). It called the ban temporary, until it had a secure environment. It also asked staff not to put company information into AI tools on their own devices.

A small firm has no internal network to lock down and no in-house tool to offer. Its staff carry the tools in their pockets. Microsoft and LinkedIn's 2024 Work Trend Index surveyed 31,000 knowledge workers in 31 markets. It found that 78% of AI users brought their own AI tools to work, rising to 80% at small and medium-sized companies.

A ban moves that use onto personal accounts. There you can't see what goes in, can't switch off model training, and can't recover the work when the person leaves. The UK's National Cyber Security Centre advises not to include sensitive information in queries to public LLMs, because the provider can see and store them. The practical answer is a business account for the tools people already want, with settings you choose, and a clear rule on what goes in.

What an AI policy for a small business should include: an outline to copy

Here is the outline we would start from. Each part runs to a few lines.

1. Purpose, owner and review date. One sentence on why the policy exists, the name of the person who owns it, and when it will next be reviewed.
2. Who it covers. Employees, freelancers, contractors and agency staff, on any device, whenever they work for you.
3. Approved tools. A named list with the plan and account for each: "business plan, company workspace", not the tool's name alone. Include AI inside software you already pay for, such as meeting summaries. Anything else needs approval first.
4. Accounts. Company work happens on company accounts, opened and closed by the policy owner, with model training switched off where the tool allows it. Access ends on a person's last day.
5. Data. What may go into any approved tool, what may go in only for an approved use, and what never goes in.
6. Uses that need approval. A short list, and the name of the person who approves.
7. Checking output. Whoever uses AI owns the result. Facts, figures, names, quotes and references get checked against the source before anything leaves the firm.
8. Telling people. When clients, customers and job applicants are told that AI was used, and how.
9. What AI must not do here. For example, decide about a person on its own, or send a customer something nobody has read. Our checklist of what not to automate with AI has more.
10. Mistakes and requests. Who to tell when something goes wrong, such as client data pasted into the wrong tool, with a promise that early reporting won't be punished. How to ask for a new tool, and how soon you'll answer.
11. Training. What everyone learns when they join, and again when an approved tool changes.

That's eleven parts on two pages. Parts 3, 5 and 6 are the ones people argue about, so the next three sections take them in turn.

Which AI tools, and whose account

Approve tools by account, not by brand. The same chatbot comes as a personal account, whose conversations may train the provider's models, or as a business plan run by an administrator. OpenAI's help centre explains the "Improve the model for everyone" setting, which decides whether a personal ChatGPT account's new conversations train its models. Check each provider's current terms for its business plans, because they change.

Company accounts matter for a second reason: ownership. When we build software, the client owns the code, domain, hosting and documentation, in their own accounts. Leaving us never means losing anything. Apply the same rule to AI. Prompts, saved projects and custom assistants built on a personal account leave the company with the person who built them.

Keep an approved-tools register. A shared sheet with seven columns will do: tool, plan, administrator, data it may take, approved uses, date approved, next review. List the AI inside your existing software too, such as meeting recorders and the AI in your CRM. Meeting recorders need the most care, because they capture everyone on the call, including clients, who should know one is running.

What data can go into an AI tool

Sort your information into four classes and say where each may go. Say you run a 25-person accountancy practice in Leeds. Its table might look like this.

Personal data changes the legal position. Putting a customer's or employee's details into an AI tool is processing under UK and EU GDPR. You need a lawful basis, and your privacy notice has to cover it. The provider becomes your processor, which requires a contract with set terms (ICO).

Where the provider stores the data matters too. Our guide to ChatGPT, customer data and GDPR covers processor terms and data residency in detail.

Client contracts can be stricter than the law. Confidentiality clauses often forbid passing a client's information to third parties, and an AI provider is a third party. Read the contracts of your three biggest clients before you approve any tool for their work.

Which uses need approval, and who gives it

Most AI use needs no approval: drafting and summarising on an approved tool, with the person checking the result. Approval is for uses where a mistake costs more than an edit. Five triggers cover most of them:

1. A new tool, or a new plan of one you already use.
2. Personal or client data used in a way nobody has approved yet.
3. Output that reaches a customer or the public before a person reads it.
4. A decision, ranking or score about a person: hiring, performance, pay, credit.
5. A connection to your systems that lets AI act on its own: send, pay, delete or change records.

One named person approves, with a deputy for holidays. In a firm of 20, that's usually the owner or the operations lead. Promise an answer within a set time, such as a week. An approval that takes longer than opening a personal account gets skipped.

Record each approval as fields, not as an email thread: tool, use, data, decision, reason, date, review date. An empty field is easy to spot; a missing sentence in an email isn't. For uses that act or decide, the approval step itself needs designing. Our guide to human-in-the-loop AI shows how to stop it becoming a rubber stamp.

Checking AI output, and saying when you used it

Whoever uses AI owns what it produces. Write that down, because a fluent draft looks finished, and checking it starts to feel optional.

Deloitte Australia found this out in public. In 2025 it delivered a report to Australia's Department of Employment and Workplace Relations on a welfare compliance framework. A University of Sydney researcher, Chris Rudge, found references to research that didn't exist and a made-up quote from a federal court judgment (Fortune).

The first version hadn't mentioned AI. The corrected one disclosed that an Azure OpenAI tool had been used. Deloitte agreed to repay part of its fee and said its findings and recommendations were unchanged (The Guardian).

Two lines in a policy would have caught it. First, a person checks every fact, quote and reference against its source before work leaves the firm. Second, when AI helped produce something a client pays for, say so before they find out. Acas gives UK employers the same advice: check AI outputs "for accuracy, tone and bias", and cite AI when it's used (Acas, May 2025).

We hold ourselves to both. Every post on this blog, this one included, ends with a note on how it was written.

Customers talking to a chatbot are a separate case with its own rule. Since 2 August 2026, the EU AI Act has required a chatbot to tell people it's an AI from the first message. Our guide to putting an AI chatbot on your website covers what that means in practice.

What UK and EU law asks of your AI policy

No UK or EU law requires a small firm to write a document called an AI policy. Several rules are much easier to meet with one. We aren't lawyers, and this isn't legal advice, so check anything that affects a decision with yours.

The literacy duty is lighter than it was. Since the AI omnibus came into force on 27 July 2026, Article 4 asks for measures "to support the development of AI literacy". It no longer requires "a sufficient level" of it. For a small firm, one short training session with an attendance note is a reasonable measure.

The Act can also reach a UK firm whose AI output is used in the EU. Our guide to the EU AI Act for small businesses covers the dates and duties by role.

Employment practice matters as much as data law. Acas advises employers to have clear AI policies and to consult staff when they introduce AI. If you plan to check what people type into AI tools, the ICO's monitoring guidance applies. You must tell staff what you collect and choose the least intrusive means, and high-risk monitoring needs a data protection impact assessment first. In Germany, a works council has a say over technical systems designed to monitor staff conduct or performance (BetrVG section 87).

Rolling out the policy so people follow it

A policy your staff helped write gets followed. One that arrives as an email attachment gets filed. If breaking it could lead to disciplinary action, the Acas Code of Practice also applies. It says rules should be written down, specific and clear, developed with employees involved, and explained so people know where to find them.

1. Ask what people already use, with no blame attached. The question is at the end of this guide.
2. Draft the policy with the two or three people who use AI most. They know which rules will be ignored.
3. Set up the approved tools before the policy starts, so the rule and the better tool arrive on the same day. Help people move useful work out of personal accounts.
4. Train everyone in one short session, with examples from your own work: a good use, a data mistake, an invented reference. Note who attended.
5. Put the policy where your team already looks for how things are done. If that place doesn't exist yet, a company second brain is one answer.
6. Review it on the date in part 1, and whenever an approved tool changes its terms.

When you don't need a written AI policy, or us

Some firms need less than eleven parts, and most don't need outside help to write them.

• A firm of five, where the owner sees everyone's work daily, can manage with one approved tool and a handbook paragraph on what never goes in.
• If your professional body or regulator publishes AI guidance for your sector, start from that and add only what it leaves out.
• If nobody at your firm handles personal or client data, the data rules shrink to a line or two.

You don't need us to write the policy either. This outline and a morning with your heaviest AI users will produce a good first version. Outside help earns its place where the policy meets your systems. That means connecting AI to client data, adding an approval step to an automation, or deciding which uses are worth doing at all. That is the work we do, and we'll tell you when a use isn't worth it.

Start with one question this week

This week, ask your team one question in writing. Which AI tools have you used for work in the last month, on which account, and for what? Promise that nobody will be in trouble for the answer.

The replies are the first draft of your approved-tools register. They also show you which data rule to write first: the one somebody has already needed.

Questions

Is there an official UK template for an AI policy?

Not for private firms, as of September 2026. The government consulted on a self-assessment tool called AI Management Essentials, and in its December 2025 response said it would develop simpler guidance aimed at small and medium-sized firms instead. The civil service's AI Playbook is public and sets out ten principles. It's written for government, but its principles on security and human control translate to a small firm.

Should the AI policy go into employment contracts?

Usually not. Acas says any change to an employment contract must be agreed by both the worker and the employer, and AI tools change every few months. Many firms keep a policy like this in the staff handbook, outside the contract, so they can update it, and rely on the contract's existing duty of confidentiality. How your contracts are worded decides this, so ask an employment adviser.

Does the policy cover freelancers and contractors?

It should, because they handle the same data. A staff handbook usually doesn't bind them, so put the key rules (approved tools, data limits, disclosure) into their contracts. The EU AI Act's literacy duty also reaches beyond employees, to other people using AI systems on your behalf.

How we wrote this: drafted with AI, then checked and edited by the people who build our projects. Figures come from our own work or from the linked sources.